... yes - that's why you can do a filter of "AND NOT ..." ... as long as you can write it as a legitimate AD query (and you can test the results first, to make sure you're targeting what you're intending to target) ...

Here's a few things that you may want to read up on to help you out with the LDAP syntax side of things: